Null-dereference READ in blink::Document::View |
||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5662136901304320 Fuzzer: inferno_twister Job Type: linux_ubsan_chrome Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000210 Crash State: blink::Document::View blink::Document::UpdateStyleAndLayoutIgnorePendingStylesheets blink::FrameSelection::ComputeVisibleSelectionInDOMTreeDeprecated Sanitizer: undefined (UBSAN) Regressed: https://clusterfuzz.com/revisions?job=linux_ubsan_chrome&range=537003:537004 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5662136901304320 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Oct 1
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/1d692b441a4fe9771fbefa6cd9647e6f8ddf1822 ([PaintWorklet] Fix crash when hitting breakpoint during lifecycle). If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
,
Dec 6
I did some investigation, and found that the actually problem is that when the code path is in FrameSelection::ComputeVisibleSelectionInDOMTreeDeprecated, it calls the FrameSelection::GetDocument(), and that the LifecycleContext() is nullptr. I don't have enough knowledge on printing to propose a solution. yosin@: could you take a look? I see that you have recently changed the frame_selection code.
,
Dec 6
,
Dec 10
un-assign myself as this is a editing bug.
,
Jan 7
Duplicate of bug 890585 ? |
||||
►
Sign in to add a comment |
||||
Comment 1 by ClusterFuzz
, Oct 1Labels: Test-Predator-Auto-Components